Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Sometimes I have to open files (doc, zip, txt, pdf and some other) downloaded from the Internet (from unproven sites) on my computer.

How could I mitigate the risk and open them in a more or less secure way?

What types of files are more insecure than the other?

share|improve this question
1  
Voted as off-topic. This site is for IT professionals. For that type of question, I would recommend superuser.com –  Olivier Lalonde Nov 13 '10 at 18:42
1  
That is quite arguably - "off-topic". Topic is related to security, isn't it? IT security professionals deal also with end-user security policies. –  anonymous Nov 13 '10 at 18:46
2  
It's all about the way it's worded. First, OP didn't mention an OS which clearly hints he is not a professional and second, he plainly said "on my computer". –  Olivier Lalonde Nov 13 '10 at 18:52
2  
The discussion about wheter this is off-topic or on-topic should be moved to this meta question meta.security.stackexchange.com/questions/16/… –  HoLyVieR Nov 13 '10 at 20:10
    
Specifically this question, if it were to be worded along the lines of "Which files are more insecure than others" in the context of handling them, either in code, on server, etc, and how do I handle them in my program,... this would be more on-topic. –  AviD Nov 14 '10 at 2:05
add comment

3 Answers

up vote 7 down vote accepted

What I can suggest:

  • open files inside VM's if it is possible, or, as @Henri said, use sandbox;
  • run AV software, at least it adds some security level;
  • you can use online AV scanner solutions like virustotal.com;
  • never trust any file from any source - friends can also be compromised, they can spread malware without their knowledge;
  • use updated software;

You should take into mind that software does not guarantee 100% protection. Only right policy and your experience can help to decrease risk and mitigate attacks.

share|improve this answer
    
No one would like to explain why this answer has gained -1 and @Henri's +1? –  anonymous Nov 13 '10 at 19:06
add comment

The best way to open such files is by running them inside a sandbox. I would suggest a virtual machine.

Regarding which kind of files are safe, one can make two distinctions. In practice, files like zip, txt, jpg, png, etc are safe. Files like .exe, .msi, .com, .bat, .vbs, etc etc are unsafe. However, there is one big issuge with "safe" files, it is possible that due to an security vulnerability in the application that is used to open it, your systems security is compromised. An example is a recently released 0day for Acrobat Reader in combination with maliciously crafted pdfs.

share|improve this answer
2  
This is not correct about file type extensions. Every file is considered to be harmful. For example, there exists so called "joiners" that allows to join picture with malware. User is not able to distinguish such file from unsafe. There are a lot of other examples how malware can be hidden. –  anonymous Nov 13 '10 at 18:37
1  
Yes, but given that your png viewer is safe, the malicious malware cannot be executed in the jpg...as far as i know. Im curious how the malware can be executed. –  Henri Nov 14 '10 at 12:36
1  
Thanks - good info on file types. The poster asked about .doc which is much trickier than most. Macros are a huge issue, though they are handled somewhat better now than in the past. Some discussion of how high the stakes are would make sense - i.e. if you're not a big target, then opening non-executables from not-too-shady sites on a completely updated system is not too dangerous, but if you are a big target, then 0-day attacks are a huge issue. –  nealmcb Nov 26 '10 at 6:12
    
"given that your png viewer is safe" - Do they make safe ones? –  rox0r Dec 14 '10 at 17:26
add comment

Sandboxie is what you are looking for (if you have windows). It's also free.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.